Network basics: the OSI model, TCP/IP and common ports

You cannot protect a network you cannot describe. Every firewall rule, alert and log line is written in the language of networking: addresses, protocols, ports and layers. This lesson gives you that vocabulary. The University’s TCP/IP and DNS courses go deeper; here the goal is a working map you can use in every lesson that follows.

Layers: splitting a hard problem into pieces

Sending a message across the world involves physical signals, local delivery, global routing, reliable delivery and the application’s own format. Network engineers split this into layers, each doing one job and relying on the layer below. The OSI reference model, standardised by the ITU as X.200 and by ISO, uses seven layers. The internet itself runs on the simpler TCP/IP model, usually drawn with four layers. The OSI numbers survive in everyday speech: a “layer 7 firewall” looks at applications, a “layer 3 device” routes IP packets.

IP addresses: where

Every device on a network has an IP address. IPv4 addresses look like 203.0.113.7; IPv6 addresses look like 2001:db8::7. Some ranges are reserved for private networks and never appear directly on the internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 (defined in RFC 1918). Your home router gives your devices private addresses and translates them to its single public address when they go online. Recognising private addresses matters in security: a connection to 192.168.1.20 stays inside your home or office, a connection to a public address leaves it.

TCP and UDP: how

The transport layer offers two main services. TCP (Transmission Control Protocol) sets up a connection with a handshake, numbers every byte, resends what is lost and delivers everything in order: ideal for web pages, email and file transfers. UDP (User Datagram Protocol) just sends packets with no guarantees: ideal for voice, video, games and DNS lookups, where speed matters more than perfection. QUIC, the protocol behind HTTP/3, builds reliability on top of UDP.

Ports: which program

An IP address gets data to a computer; a port number (0 to 65535) gets it to the right program on that computer. Servers listen on well-known ports registered with IANA, so clients know where to knock. Your side of the connection uses a temporary high-numbered port chosen by the operating system.

Why ports alone are no longer enough

Traditional firewalls decided mostly by address and port: allow 443, block 3389. Today almost everything, good and bad, travels over port 443 inside encrypted HTTPS, so “port 443 is allowed” says very little. That is why modern host firewalls also look at which application is making the connection. FireAI, for example, identifies each app by its code signature and lets you allow or deny that specific app, rather than a whole port. It can also read what an encrypted connection announces at its start, such as the website name, without ever decrypting the content.

A connection, end to end

1. An app wants to reach example.com. It asks DNS (port 53) for the address.
2. The operating system opens a TCP connection from a temporary port to that address on port 443.
3. Your router forwards it, translating your private address to its public one.
4. Routers across the internet pass the IP packets towards the destination.
5. TLS encrypts the conversation; HTTP carries the actual request inside it.

Each of these steps is a place where security can be applied, and where an attacker might try to interfere. The next lessons look at the defences built around them.